Analysis
- max time kernel
40s - max time network
42s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/10/2026, 03:23
Behavioral task
behavioral1
Sample
293c3e20c87639896d2847bd8cfe71c8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
40 seconds
Behavioral task
behavioral2
Sample
293c3e20c87639896d2847bd8cfe71c8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
40 seconds
General
- Target 293c3e20c87639896d2847bd8cfe71c8.exe
- Size 55KB
- Sample261021-dxfx5aeb24
- SHA256 d65e2eb84444c69bc58ea794056f7d2b00f517a484efbf62f6e10e4bfc15c585
- MD5 293c3e20c87639896d2847bd8cfe71c8
- SHA1 04905e5fde4c17c94851dd386bc2038c166d6ba2
- SHA512 84c4bd0bf6386bab74a8157b558d45fadfcead27835b7b75f4604091264dd09df745a77d13ebad9a7789596ed466b6740daecbfeba6a27ba149f5d9014392bdd
- SSDEEP 1536:AfZMDnE4uNhty4X+SChDmwsNMDFdXExI3pmom:MMDnlIk4XohDmwsNMDFdXExI3pm
- TLSH T188432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f9b9a225fb8f5c2506e0df5a97ae95ee.exe 293c3e20c87639896d2847bd8cfe71c8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f9b9a225fb8f5c2506e0df5a97ae95ee.exe 293c3e20c87639896d2847bd8cfe71c8.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\f9b9a225fb8f5c2506e0df5a97ae95ee = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\293c3e20c87639896d2847bd8cfe71c8.exe\" .." 293c3e20c87639896d2847bd8cfe71c8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f9b9a225fb8f5c2506e0df5a97ae95ee = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\293c3e20c87639896d2847bd8cfe71c8.exe\" .." 293c3e20c87639896d2847bd8cfe71c8.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 293c3e20c87639896d2847bd8cfe71c8.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 293c3e20c87639896d2847bd8cfe71c8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 293c3e20c87639896d2847bd8cfe71c8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 293c3e20c87639896d2847bd8cfe71c8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 293c3e20c87639896d2847bd8cfe71c8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe 4744 293c3e20c87639896d2847bd8cfe71c8.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: SeDebugPrivilege 5404 293c3e20c87639896d2847bd8cfe71c8.exe Token: 33 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: SeIncBasePriorityPrivilege 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: 33 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: SeIncBasePriorityPrivilege 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: 33 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: SeIncBasePriorityPrivilege 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: 33 4744 293c3e20c87639896d2847bd8cfe71c8.exe Token: SeIncBasePriorityPrivilege 4744 293c3e20c87639896d2847bd8cfe71c8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\293c3e20c87639896d2847bd8cfe71c8.exe"C:\Users\Admin\AppData\Local\Temp\293c3e20c87639896d2847bd8cfe71c8.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
C:\Users\Admin\AppData\Local\Temp\293c3e20c87639896d2847bd8cfe71c8.exe"C:\Users\Admin\AppData\Local\Temp\293c3e20c87639896d2847bd8cfe71c8.exe" ..1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5404